aflpp

Write a libFuzzer-style LLVMFuzzerTestOneInput harness, compile with afl-clang-fast++ using -fsanitize=fuzzer, create a seed corpus with at least one non-empty input, then run afl-fuzz with -i seeds and -o out directories.

AFL++ is best for multi-core fuzzing, diverse mutation strategies, and mature production codebases. libFuzzer suits quick setup and single-threaded fuzzing with simple harnesses, while LibAFL targets custom research-grade fuzzers.

Start one primary instance with afl-fuzz -M primary and secondary instances with -S secondary01, -S secondary02, sharing the same -i seeds and -o state directories. Monitor all jobs with afl-whatsup.

Yes, compile with AFL_USE_ASAN=1 to enable AddressSanitizer. Note that the -m memory limit flag is unsupported with ASan due to its 20TB virtual memory reservation, and a common setup uses one ASan job among several non-ASan jobs.

Low exec/sec (under 1k) usually means you are not using persistent mode. Create an LLVMFuzzerTestOneInput-style harness instead of stdin fuzzing, and set AFL_TMPDIR=/dev/shm to avoid disk I/O bottlenecks.

Avoid AFL++ for quick single-threaded prototyping where libFuzzer is simpler, or when you need fully custom mutators where LibAFL fits better. Also do not fuzz on production systems since afl-system-config disables OS security features.